crun

Free plan LinuxSelf-hosted

What crun is

crun is a Linux OCI container runtime written in C, designed for low memory use. It conforms to the OCI Container Runtime specifications and offers commands to create, run, execute in, list, pause, resume, update, checkpoint and restore containers. When run by a non-root user, it can create a user namespace automatically and generate configuration for unprivileged use. The project documents integration with Podman through its runtime option, an Ansible role for installing a static binary, and a Lua binding. It lists release binaries for Linux amd64 and arm64, including builds without systemd, and provides GPG instructions for checking signed official artifacts. Its README reports that 100 sequential `/bin/true` containers took 1.69 seconds with crun versus 3.34 seconds with runc on the README author's machine. crun is free, with a listed price of $0. The manual marks cgroup v1 support as deprecated and says it will be removed in a future release.

Who it suits

crun suits Linux users and self-hosted teams that need an OCI-compatible runtime, including those managing containers with Podman. Its unprivileged mode may suit users who need to run containers without root privileges.

What it does well

Conforms to OCI Container Runtime specifications.
Offers rootless use with automatic user namespaces.
Release binaries listed for amd64 and arm64.
Documents Podman integration and a Lua binding.

What to know first

Linux only; Windows containers are not supported.
cgroup v1 support is deprecated.
Prior-version fixes are best effort, not guaranteed.

Plans

Plan	Billed and limits	Price
crun	OCI container runtime · source build and release binaries	Free

As github.com lists them, read 3 Oct 2026. The maker's own page has the final word.

Getting started

Visit the crun project page and choose a Linux release binary or follow build instructions for your distribution.
Verify an official release artifact with the project's GPG instructions.
Install crun on a Linux host.
Use crun's command-line operations to manage containers, or select it as the runtime in Podman.
For unprivileged use, generate a user configuration file and run crun as a non-root user.

Verdict

crun provides a free, Linux-focused OCI runtime with command-line container operations and rootless support. Note the cgroup v1 deprecation and limited guarantees for fixes to older versions.

Questions

How much does crun cost?

The listed crun plan costs nothing and includes the OCI container runtime, source build and release binaries.

Which operating systems does crun support?

The listed host operating system is Linux, including Fedora, RHEL/CentOS, Ubuntu, Alpine and openSUSE Tumbleweed. Windows containers are listed as unsupported.

Can crun run containers without root privileges?

Yes. It can generate a configuration file for an unprivileged user and automatically creates a user namespace when run by a non-root user.

Can I use crun with Podman?

Yes. The project documents selecting crun with Podman's runtime option.

How are vulnerabilities reported?

The security policy asks reporters to use GitHub Security Advisories rather than public issues or pull requests. The project aims to acknowledge reports within three business days.

What support is provided for older versions?

The latest version receives regular patch releases. Fixes for prior versions are best effort and are not guaranteed unless a support matrix specifies otherwise.

Facts from crun's own pages

Artifact verification: The README says official release artifacts are signed and provides GPG commands to verify them against the repository keyring. · github.com, 3 Oct 2026
Build platforms: The README lists build instructions for Fedora, RHEL/CentOS Stream 9 and 10, Ubuntu, Alpine, and openSUSE Tumbleweed. · github.com, 3 Oct 2026
cgroup limit: The manual says cgroup v1 support is deprecated and will be removed in a future release. · github.com, 3 Oct 2026
Container operations: The command-line interface includes create, run, exec, list, pause, resume, update, checkpoint, and restore operations. · github.com, 3 Oct 2026
Contributor requirements: The contribution guide says contributors need C knowledge and a Linux environment, and requires a Developer Certificate of Origin sign-off for pull requests. · github.com, 3 Oct 2026
Free plan: Yes · github.com, 22 Sept 2026
Integration: The README demonstrates using crun with Podman via the --runtime option. · github.com, 3 Oct 2026
Integrations: The README documents an Ansible role for automating installation of a statically linked binary and says a Lua binding is available. · github.com, 3 Oct 2026
Library: The project aims to make crun usable as a library for programs that manage OCI containers without an external process. · github.com, 3 Oct 2026
Maintainer: The latest release page credits Giuseppe Scrivano as the release author. · github.com, 3 Oct 2026
OCI compatibility: crun conforms to the OCI Container Runtime specifications. · github.com, 3 Oct 2026
Performance: The README reports that, on the maintainer’s machine, running 100 sequential /bin/true containers took 1.69 seconds with crun and 3.34 seconds with runc. · github.com, 3 Oct 2026
Product: crun is a fast, low-memory-footprint OCI container runtime written in C. · github.com, 3 Oct 2026
Purpose: crun is a fast, low-memory-footprint OCI container runtime written in C. · github.com, 3 Oct 2026
Releases: The releases page lists Linux amd64 and arm64 binaries, including variants built with systemd disabled. · github.com, 3 Oct 2026
Release verification: The project says official release artifacts are signed with keys listed in crun.keyring and provides GPG verification commands. · github.com, 3 Oct 2026
Response target: The security policy aims to acknowledge reports within 3 business days. · github.com, 3 Oct 2026
Rootless use: crun can generate a configuration file for an unprivileged user and automatically creates a user namespace when run by a non-root user. · github.com, 3 Oct 2026
Security practices: The security policy says CI runs fuzz testing with honggfuzz, AddressSanitizer runtime analysis, and clang-check and clang-format quality checks on pull requests. · github.com, 3 Oct 2026
Security reporting: The security policy directs vulnerability reports through GitHub Security Advisories rather than public issues or pull requests. · github.com, 3 Oct 2026
Security response: The project aims to acknowledge security reports within three business days and says confirmed issues are handled according to severity and impact. · github.com, 3 Oct 2026
Security testing: The security policy says the codebase is fuzz-tested with honggfuzz and checked with AddressSanitizer, clang-check, and clang-format in CI. · github.com, 3 Oct 2026
Steward: The security policy identifies Red Hat, Inc. as the project's open source software steward under the EU Cyber Resilience Act. · github.com, 3 Oct 2026
Support coverage: The project says it regularly issues patch releases for the latest version, while fixes for prior releases are best effort and not guaranteed. · github.com, 3 Oct 2026